WHOIS data is the public registration record for a domain name or IP address — it tells you which registrar a domain was bought through, when it was created, updated, and expires, which name servers it uses, what status locks are applied, and (when not redacted) who registered it. It is served by a query/response protocol originally defined in RFC 3912, coordinated through the registry that operates each top-level domain and the registrar that sold the name. Since privacy rules tightened in 2018, the contact fields are usually hidden — so a modern WHOIS record is most valuable for its dates, registrar, name servers, and status codes, which are authoritative and hard to fake.
That's the summary an AI overview will give you. What it can't give you is the part that makes WHOIS actually useful in an investigation: how a query travels from your machine to the right database, which fields to trust versus corroborate, and what every status code and redaction placeholder really means. This guide is the field manual — read it alongside our companion posts on WHOIS accuracy and its limitations, interpreting WHOIS dates for security, RDAP versus WHOIS, and privacy, GDPR, and redaction.
How a WHOIS query actually works
When you look up a domain, your query doesn't hit one big database — it's routed. Your client asks the registry (or a thin/thick WHOIS server) which registrar holds the name, and the authoritative record is assembled from the fields the registry controls plus the fields the registrar stores. Understanding that path explains why some fields are trustworthy and others are self-reported.
Every WHOIS field, and what it means
A raw record is a wall of key/value lines. Here is what each field is telling you, and how much you can trust it:
| WHOIS field | What it means | Trust level |
|---|---|---|
| Domain Name | The domain the record describes (normalized to uppercase in many gTLD records). | Authoritative |
| Registry Domain ID | A unique registry identifier for the domain (e.g. 12345678_DOMAIN_COM-VRSN). | Authoritative |
| Registrar | The company that sold/manages the registration (GoDaddy, Namecheap, Cloudflare…). | Authoritative |
| Registrar IANA ID | The registrar's numeric ID in IANA's accreditation list — use it to identify the exact abuse contact. | Authoritative |
| Creation Date | When the domain was first registered. A very recent date is a top phishing/fraud signal. | Authoritative |
| Updated Date | Last change to the registration record — often a routine registrar update, not a change of owner. | Authoritative (but easily misread) |
| Registry Expiry Date | When the current registration period ends; drives renewal, drop-catch, and acquisition timing. | Authoritative |
| Name Server | The DNS servers authoritative for the domain; reveal the hosting/DNS provider and can link related domains. | Authoritative |
| Domain Status | EPP status codes describing locks and lifecycle state (see the table below). | Authoritative |
| DNSSEC | Whether DNSSEC signing is enabled (signedDelegation / unsigned). | Authoritative |
| Registrant Name / Organization | Who registered the domain — frequently REDACTED FOR PRIVACY since 2018. | Self-reported; often redacted |
| Registrant Email / Phone / Address | Registrant contact details — usually hidden behind privacy or a proxy relay. | Self-reported; often redacted |
| Admin / Tech Contact | People authorized to change the registration or handle technical issues; almost always redacted now. | Self-reported; often redacted |
The split is the key insight: the registry-controlled fields at the top are hard to falsify, while the registrant-supplied contact fields at the bottom are self-reported and, since privacy rules tightened, mostly hidden. Build your conclusions on the former and corroborate the latter — the accuracy and limitations guide goes deeper on where WHOIS lies.
Reading a real WHOIS record
Here's what a typical record looks like, annotated by the table above:
Domain Name: EXAMPLE.COM
Registry Domain ID: 12345678_DOMAIN_COM-VRSN
Registrar: Example Registrar, Inc.
Registrar IANA ID: 9999
Creation Date: 1995-08-14T04:00:00Z
Updated Date: 2023-08-14T09:00:00Z
Registry Expiry Date: 2025-08-13T04:00:00Z
Domain Status: clientTransferProhibited
Name Server: NS1.EXAMPLE.COM
Name Server: NS2.EXAMPLE.COM
DNSSEC: unsigned
The Z on every timestamp means UTC — a detail that trips up date-based analysis if you assume local time. For why that matters in security work, see interpreting WHOIS dates for domain security.
Domain status (EPP) codes decoded
The Domain Status lines are EPP status codes — a standardized vocabulary shared across gTLDs. A client prefix means the registrar set the code; a server prefix means the registry set it (usually harder to remove, often tied to a legal or dispute action). Multiple codes are normal and usually indicate protective locks, not trouble:
| Status code | Set by | What it means |
|---|---|---|
clientTransferProhibited | Registrar | Standard lock preventing transfer to another registrar. A healthy default, not a red flag. |
clientDeleteProhibited | Registrar | Blocks accidental or unauthorized deletion of the domain. |
clientUpdateProhibited | Registrar | Blocks changes to the registration details. |
clientHold | Registrar | Registrar has removed the domain from the DNS zone — it won't resolve. |
serverHold | Registry | Registry has pulled the domain from DNS, often for non-payment or a dispute. |
serverTransferProhibited | Registry | Registry-level transfer lock, commonly during legal action. |
pendingDelete | Registry | The domain is scheduled for deletion and will soon drop. |
redemptionPeriod | Registry | The domain expired and is in a ~30-day grace window where the owner can still restore it. |
pendingTransfer | Registry | A transfer to another registrar is in progress. |
ok (a.k.a. active) | Registry | No restrictions applied — ironically the least protected state. |
WHOIS for security investigations
Security professionals lean on WHOIS for:
Investigating phishing domains. New domains (created within the past few days or weeks) hosting login pages are often phishing attempts. The Creation Date is the single most useful field for this.
Tracking threat actors. Attackers often register many domains. Shared name servers, the same registrar, correlated creation dates, or reused (rare, but it happens) contact fragments can cluster a campaign.
Verifying legitimate businesses. Before dealing with an unfamiliar company, domain age and registration details can reveal red flags — a "20-year-old brand" on a domain registered last month doesn't add up.
Identifying domain squatters. Finding who registered typosquatting or brand-infringing domains supports trademark enforcement, even when contacts are redacted (the registrar and IANA ID still give you an abuse route).
Privacy protection, GDPR, and redaction
Since GDPR took effect in May 2018, most WHOIS records show redacted contact data. ICANN's Temporary Specification directed registrars to stop publishing personal fields publicly, so you'll frequently see:
Registrant Name: REDACTED FOR PRIVACY
Registrant Organization: REDACTED FOR PRIVACY
Registrant Email: Please query the RDDS service of the Registrar
Many registrars also apply privacy/proxy services by default, replacing registrant details with relay contacts. This is legitimate privacy protection, not an indicator of malicious intent — plenty of ordinary businesses and individuals use it. To reach the underlying data you typically go through the registrar's RDDS or a formal legal request. The full mechanics are in our privacy, GDPR, and redaction guide.
WHOIS is being replaced by RDAP
Legacy WHOIS returns free-form text over an old, unstructured protocol. RDAP (Registration Data Access Protocol) is its ICANN-mandated successor: it returns structured JSON over HTTPS, with standardized fields, consistent redaction, internationalization, and support for tiered/authenticated access. gTLD registries and registrars have been required to operate RDAP since 2019, and most modern lookup tools now query RDAP behind the scenes and present it in a familiar layout. If you script domain research, prefer RDAP's JSON — see what RDAP is and how it differs from WHOIS.
Using WHOIS data responsibly
WHOIS data is appropriate for security research and incident response, legal investigations and trademark protection, due diligence on business partners, and understanding ownership for acquisitions. It is not appropriate for spam or unsolicited marketing, harassment of domain owners, or bulk harvesting for resale — uses that ICANN policy and privacy law both restrict.
Practical applications
Domain purchase negotiations. Check the Registry Expiry Date. Domains near expiration may become available, or the owner may be motivated to sell.
Competitor research. Knowing when a competitor registered a key domain, and which registrar and name servers they use, can inform your own domain strategy.
Brand protection. Regular WHOIS/RDAP monitoring for look-alike domains catches infringement early — the creation date tells you how fresh the threat is.
Look up WHOIS data
Use our WHOIS Lookup tool to query registration information for any domain. It returns registration and expiration dates, name servers, domain status codes, registrar details, and the registrant fields when they're available. Understanding WHOIS data — and knowing which fields to trust — empowers you to make informed decisions about domain security, business relationships, and online investigations.